openldap-technical

openldap-technical@openldap.org

9 participants
9868 discussions

Re: OpenLDAP 2.3 to 2.4 Migration Question
by Razi Ahmad 21 Aug '19

21 Aug '19

Thanks, I'll do that. -- Razi Ahmad Director, IT Infrastructure Services NYU Stern School of Business 14 East 4th Street, Room 327, New York, NY 10012 Phone: 212-998-0172 | Email: razi(a)stern.nyu.edu Follow us on Twitter: @nyustern An Education in *Possible* On Tue, Aug 20, 2019 at 6:36 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, August 20, 2019 7:32 PM -0400 Razi Ahmad <razi(a)stern.nyu.edu> > > wrote: > > > > > Thanks, Quanah. I did that and see that memberof was populated. However, > > I also noticed that the number of groups returned when I query for the > > memberOf attribute on one account doesn't match the number of groups > > returned when I search for all groups that this particular user is a > > member of. Do you have any ideas what could be the cause of this mismatch > > or where I should look when troubleshooting? I checked a few other > > accounts and the numbers match. > > Hi Razi, > > Not without more information. What version of OpenLDAP 2.4 did you > upgrade > to? Are all the groups of the same objectClass type? I assume the other > users are also in those same groups? You could try deleting and re-adding > the user as a member to see if that resolves it. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

1 0

Re: OpenLDAP 2.3 to 2.4 Migration Question
by Razi Ahmad 21 Aug '19

21 Aug '19

Thanks, Quanah. I did that and see that memberof was populated. However, I also noticed that the number of groups returned when I query for the memberOf attribute on one account doesn't match the number of groups returned when I search for all groups that this particular user is a member of. Do you have any ideas what could be the cause of this mismatch or where I should look when troubleshooting? I checked a few other accounts and the numbers match. Thanks, Razi -- Razi Ahmad Director, IT Infrastructure Services NYU Stern School of Business 14 East 4th Street, Room 327, New York, NY 10012 Phone: 212-998-0172 | Email: razi(a)stern.nyu.edu Follow us on Twitter: @nyustern An Education in *Possible* On Tue, Aug 20, 2019 at 4:31 PM Quanah Gibson-Mount <quanah(a)symas.com> wrote: > > > --On Tuesday, August 20, 2019 5:17 PM -0400 Razi Ahmad <razi(a)stern.nyu.edu> > > wrote: > > > > > Hi, > > > > > > I'm working on migrating from OpenLDAP 2.3 to 2.4. I've got my 2.4 > > provider set up and customized and have a copy of production data to > > load. I'd like to know if there's any way to have the memberof attribute > > populated during the process of loading the data. I used slapadd but when > > I searched for a user, I didn't see the memberOf attribute. Prior to > > running the slapadd command, I replaced the groupOfUniqueNames > > objectClass with groupOfNames and the uniqueMember attribute with member > > inside my LDIF file. > > You'll have to use ldapadd if you want memberOf populated. > > --Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

2 1

OpenLDAP 2.3 to 2.4 Migration Question
by Razi Ahmad 20 Aug '19

20 Aug '19

Hi, I'm working on migrating from OpenLDAP 2.3 to 2.4. I've got my 2.4 provider set up and customized and have a copy of production data to load. I'd like to know if there's any way to have the memberof attribute populated during the process of loading the data. I used slapadd but when I searched for a user, I didn't see the memberOf attribute. Prior to running the slapadd command, I replaced the groupOfUniqueNames objectClass with groupOfNames and the uniqueMember attribute with member inside my LDIF file. Thanks. -- Razi Ahmad Director, IT Infrastructure Services NYU Stern School of Business 14 East 4th Street, Room 327, New York, NY 10012 Phone: 212-998-0172 | Email: razi(a)stern.nyu.edu Follow us on Twitter: @nyustern An Education in *Possible*

2 1

mdb index reporting available?
by Marc Roos 20 Aug '19

20 Aug '19

I used to have some help with what and how I should add indexes, but it looks like the new mdb backend is not telling me anymore. Is this correct? Anyway to get a warning when some index needs to be set? bdb_equality_candidates: (xxxx) not indexed bdb_inequality_candidates: (createTimestamp) not indexed etc https://mishikal.wordpress.com/2013/05/16/openldap-a-comparison-of-back-mdb…

4 16

PPolicy: Multiple pwdGraceUseTime attributes
by Ulrich Windl 19 Aug '19

19 Aug '19

Hi! I noticed that one user has multiple pwdGraceUseTime attributes like this: pwdGraceUseTime: 20190409095627Z pwdGraceUseTime: 20190605063107Z pwdGraceUseTime: 20190614121258Z pwdGraceUseTime: 20190723062401Z I don't understand: Doesn't the pwdGraceUseTime record how long/often the user may login despite of an expired password? For the example given, I assume the user has changed the password a few time since the inital grace login. So aren't the older pwdGraceUseTime attributes removed after the password was changed? Or can this happen if some admin chnages the password using some plain replace operation? Regards, Ulrich

2 1

Re: Multi-master replication : read_config: no serverID / URL match found. Check slapd -h arguments.
by HG 19 Aug '19

19 Aug '19

Hi, It is not as easy as you state it. I have a 2nd set up olcServerID: 1 ldap://abc1prdp01.abcgroup.com:1600 olcServerID: 2 ldap://abc2prdp01.abcgroup.com:1600 and SLAPD_URLS="ldapi:/// ldap://:1600/" This works too. Op wo 14 aug. 2019 om 17:03 schreef Quanah Gibson-Mount <quanah(a)symas.com>: > > > --On Wednesday, August 14, 2019 11:23 AM +0200 HG > <hanspeter.sloot(a)gmail.com> wrote: > > > > > olcServerID: 1 ldap://linux1014.ts.aa-srv.com > > olcServerID: 2 ldap://linux1015.ts.aa-srv.com > > Neither of those has a trailing slash. You noted: > > SLAPD_URLS="ldapi:/// ldap://linux1014.ts.aa-srv.com/" > > doesn't start, but > > SLAPD_URLS="ldapi:/// ldap://linux1014.ts.aa-srv.com" > > starts. > > I would expect this. As I said before, it's a MATCH between what's > provided in the olcServerID field and the -h option to slapd (SLAPD_URLS > in > your case). I.e., the software is functioning as documented. If you want > it to match on the trailing slash, adjust your olcServerID values to > include a trailing slash. > > Regards, > Quanah > > -- > > Quanah Gibson-Mount > Product Architect > Symas Corporation > Packaged, certified, and supported LDAP solutions powered by OpenLDAP: > <http://www.symas.com> >

3 4

use-case for arg const char *dn of ldap_sasl_bind_s()
by Michael Ströder 18 Aug '19

18 Aug '19

HI! It seems I've never passed a DN to SASL bind functions. Could someone please elaborate on a valid use-case for argument dn of libldap function ldap_sasl_bind_s()? Thanks in advance. Ciao, Michael.

2 5

LDAPCon 2019 CFP closimg today
by Howard Chu 18 Aug '19

18 Aug '19

Just a reminder that the Call for Papers is closing today. If you've been thinking about submitting a talk, this is your last chance! https://ldapcon.org/2019 -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 1

Fresh install changing the hdb to mdb
by Marc Roos 18 Aug '19

18 Aug '19

This is the default file that rhel/centos have in their slapd.d dir for the database. I thought I would just remove this one and place the one for mdb, seems to work, don't know about this entryUUID? Or can I do this with ldapmodify? [@53386e4b0025 cn=config]# cat /tmp/olcDatabase\=\{2\}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 4f2ac1fc dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 537b0adc-5476-1039-9bf9-1dc025e1859d creatorsName: cn=config createTimestamp: 20190816133433Z entryCSN: 20190816133433.095410Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20190816133433Z [@53386e4b0025 cn=config]# cat olcDatabase\=\{2\}mdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 b6a274bd dn: olcDatabase={2}mdb objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {2}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcMdbConfig entryUUID: 537b0adc-5476-1039-9bf9-1dc025e1859d creatorsName: cn=config createTimestamp: 20190816133433Z entryCSN: 20190816133433.095410Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20190816133433Z

4 4

Initial syncreplication details
by Marc Roos 17 Aug '19

17 Aug '19

Am I correct to understand from this page[0] that the consumer gets its 'new' contextCSN from the slapcat import. (I saw it in the file). And will get all data since that date at startup? The replication id is of no influence. So if I would stop slapd import again the same old slapcat file. It would again receive all new data since that contextCSN? Regardless of the same rid being used with the provider. The idea behind this is that if you create a container with a default imported slapcat/slapadd file. Every time the task is stopped and started. It will go back to it initial container state. (unless you make it statefull of course) I am not adding that much data so I could make a new default image every week or so, this would be used every time a container is launched. (which only happens in a failover situation) [0] https://www.openldap.org/doc/admin24/replication.html

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical